diff --git a/.github/workflows/python.yaml b/.github/workflows/python.yaml index e642ccdd..40ce721a 100644 --- a/.github/workflows/python.yaml +++ b/.github/workflows/python.yaml @@ -9,7 +9,7 @@ jobs: runs-on: ${{ matrix.os }} strategy: matrix: - python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"] + python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"] os: - ubuntu-latest - macos-latest diff --git a/CHANGES.md b/CHANGES.md index 900bdbbe..fb590036 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -6,6 +6,7 @@ - [pull #692] Fix XSS from code spans in link titles (#691) - [pull #695] Fix XSS issue from incomplete tags with no attributes (#694) - [pull #700] Fix XSS from code spans in image alt text (#699) +- [pull #701] Allow boolean attribute syntax in `markdown-in-html` extra ## python-markdown2 2.5.5 diff --git a/lib/markdown2.py b/lib/markdown2.py index e50a2d9b..f2368e20 100755 --- a/lib/markdown2.py +++ b/lib/markdown2.py @@ -67,8 +67,9 @@ * link-shortrefs: allow shortcut reference links, not followed by `[]` or a link label. * markdown-file-links: Replace links to `.md` files with `.html` links -* markdown-in-html: Allow the use of `markdown="1"` in a block HTML tag to - have markdown processing be done on its contents. Similar to +* markdown-in-html: Allow the use of `markdown="1"` or simply a `markdown` boolean + attribute in a block HTML tag to have markdown processing be done on its + contents. Similar to but with some limitations. * metadata: Extract metadata from a leading '---'-fenced block. @@ -903,7 +904,8 @@ def _detab(self, text: str) -> str: re.X | re.M) _html_markdown_attr_re = re.compile( - r'''\s+markdown=("1"|'1')''') + # markdown attr, with optional assignment to true, must be followed by whitespace/boundary/closing tag chars + r'''\s+markdown(?:="1"|='1'|=1)?(?![^\s/>\b])''') def _hash_html_block_sub( self, match: Union[re.Match[str], str], @@ -927,20 +929,20 @@ def _hash_html_block_sub( if raw and self.safe_mode: html = self._sanitize_html(html) - elif 'markdown-in-html' in self.extras and 'markdown=' in html: + elif 'markdown-in-html' in self.extras and 'markdown' in html: first_line = html.split('\n', 1)[0] m = self._html_markdown_attr_re.search(first_line) if m: lines = html.split('\n') # if MD is on same line as opening tag then split across two lines - lines = list(filter(None, (re.split(r'(.*?<%s.*markdown=.*?>)' % tag, lines[0])))) + lines[1:] + lines = list(filter(None, (re.split(r'(.*?<%s.*markdown.*?>)' % tag, lines[0])))) + lines[1:] # if MD on same line as closing tag, split across two lines lines = lines[:-1] + list(filter(None, re.split(r'(\s*?.*?$)' % tag, lines[-1]))) # extract key sections of the match first_line = lines[0] middle = '\n'.join(lines[1:-1]) last_line = lines[-1] - # remove `markdown="1"` attr from tag + # remove `markdown="1"` or `markdown` attr from tag first_line = first_line[:m.start()] + first_line[m.end():] # hash the HTML segments to protect them f_key = _hash_text(first_line) diff --git a/test/tm-cases/markdown_in_html.html b/test/tm-cases/markdown_in_html.html index 128d652e..27bf00e1 100644 --- a/test/tm-cases/markdown_in_html.html +++ b/test/tm-cases/markdown_in_html.html @@ -46,3 +46,21 @@

Veggies

This is *true* markdown text. + +

Also allowed

+ +
+ +

Markdown attr without a truthy assignment, for your convenience

+ +
+ +
+ +

Mix it with other attrs, why don't you?

+ +
+ +
+The check is smarter than `if 'markdown' in text`. This is invalid +
diff --git a/test/tm-cases/markdown_in_html.text b/test/tm-cases/markdown_in_html.text index ebf04fda..e69640fd 100644 --- a/test/tm-cases/markdown_in_html.text +++ b/test/tm-cases/markdown_in_html.text @@ -17,7 +17,7 @@ And a paragraph And **this**. -
+
And even **this** in an HTML5 block tag.
@@ -33,3 +33,18 @@ And even **this** in an HTML5 block tag. This is *true* markdown text. + + +## Also allowed + +
+Markdown attr *without* a truthy assignment, for your convenience +
+ +
+Mix it with other attrs, _why don't you?_ +
+ +
+The check is smarter than `if 'markdown' in text`. This is invalid +
\ No newline at end of file diff --git a/test/tm-cases/markdown_in_html.toc_html b/test/tm-cases/markdown_in_html.toc_html index 062eaf94..d08b645c 100644 --- a/test/tm-cases/markdown_in_html.toc_html +++ b/test/tm-cases/markdown_in_html.toc_html @@ -3,5 +3,8 @@ -
  • Veggies
  • +
  • Veggies +